I

107TH CONGRESS

1ST SESSION H. R. 89

To require the Federal Trade Commission to prescribe regulations to protect

the privacy of personal information collected from and about individuals

who are not covered by the Children’s Online Privacy Protection Act

of 1998 on the Internet, to provide greater individual control over the

collection and use of that information, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

JANUARY 3, 2001

Mr. FRELINGHUYSEN introduced the following bill; which was referred to the

Committee on Energy and Commerce

A BILL

To require the Federal Trade Commission to prescribe regulations to protect the privacy of personal information

collected from and about individuals who are not covered

by the Children’s Online Privacy Protection Act of 1998

on the Internet, to provide greater individual control

over the collection and use of that information, and

for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Online Privacy Protec5 tion Act of 2001’’.
2

•HR 89 IH

1 SEC. 2. REGULATION OF UNFAIR AND DECEPTIVE ACTS

2 AND PRACTICES IN CONNECTION WITH THE

3 COLLECTION, USE AND DISCLOSURE OF PER4 SONAL INFORMATION.

5 (a) ACTS PROHIBITED.—

6 (1) IN GENERAL.—It is unlawful for an oper7 ator of a Web site or online service to collect, use

8 or disclose personal information in a manner that

9 violates the regulations prescribed under subsection

10 (b).

11 (2) DISCLOSURE.—Notwithstanding paragraph

12 (1), neither an operator of a Web site or online serv13 ice nor the operator’s agent shall be held to be liable

14 under this Act for any disclosure made in good faith

15 and following reasonable procedures in responding to

16 a request under subsection (b)(1)(B) by an indi17 vidual for disclosure of personal information per18 taining to such individual.

19 (b) REGULATIONS.—

20 (1) IN GENERAL.—Not later than 1 year after

21 the date of the enactment of this Act, the Commis22 sion shall promulgate under section 553 of title 5,

23 United States Code, regulations that—

24 (A) require the operator of any Web site or

25 online service—
3

•HR 89 IH

1 (i) to provide notice on its Web site,

2 in a clear and conspicuous manner, of the

3 identity of the operator, what personal in4 formation is collected by the operator, how

5 the operator uses such information, and

6 what information may be shared with other

7 companies; and

8 (ii) to provide a meaningful and sim9 ple online process for individuals to con10 sent to or limit the disclosure of personal

11 information for purposes unrelated to

12 those for which such information was ob13 tained or described in the notice under

14 clause (i);

15 (B) require the operator to provide, upon

16 request of an individual under this subpara17 graph who has provided personal information to

18 that Web site or online service, upon proper

19 identification—

20 (i) a description of the specific types

21 of personal information collected by that

22 operator that was sold or transferred to an

23 external company; and

24 (ii) notwithstanding any other provi25 sion of law, a means that is reasonable
4

•HR 89 IH

1 under the circumstances for the individual

2 to obtain the personal information de3 scribed in paragraph (i) from such indi4 vidual; and

5 (C) require the operator of such Web site

6 or online service to establish and maintain rea7 sonable procedures to protect the confiden8 tiality, security, and integrity of personal infor9 mation it collects or maintains.

10 (2) WHEN PURPOSE LIMITATION NOT RE11 QUIRED.—The regulations shall provide that the

12 purpose limitation required under paragraph

13 (1)(A)(ii) is not required for—

14 (A) transactional information where identi15 fiable information is not removed;

16 (B) personal information where it is used

17 to render or conduct a legitimate business activ18 ity related to the business of the operator (for

19 example, the use of an e-mail address to re20 spond to an e-mail communication); or

21 (C) the collection, use, or dissemination of

22 such information by the operator of such a Web

23 site or online service necessary to the extent

24 permitted under other provisions of law.
5

•HR 89 IH

1 (3) WHEN ACCESS NOT REQUIRED.—The regu2 lations shall provide that access as required under

3 paragraph (1)(B)(ii) is not required—

4 (A) to transactional information where

5 identifiable information is not removed;

6 (B) to information that is commercially

7 confidential to the operator and is obtained

8 from sources outside of the individual’s contact

9 with the operator’s web site;

10 (C) to information that is solely for inter11 nal company processes and is neither sold,

12 transferred, nor used for activities external to

13 the web site’s operator;

14 (D) to information that is discarded upon

15 the conclusion of the process that generates it;

16 or

17 (E) to information that has no impact

18 upon an individual.

19 (4) TERMINATION OF SERVICE.—The regula20 tions shall permit the operator of a Web site or an

21 online service to terminate service provided to an in22 dividual who has refused, under the regulations pre23 scribed under paragraph (1)(B)(ii), to permit the op24 erator’s further use or maintenance in retrievable

25 form, or future collection, of personal information.
6

•HR 89 IH

1 (c) ENFORCEMENT.—Subject to sections 3 and 5, a

2 violation of a regulation prescribed under subsection (a)

3 shall be treated as a violation of a rule defining an unfair

4 or deceptive act or practice prescribed under section

5 18(a)(1)(B) of the Federal Trade Commission Act (15

6 U.S.C. 57a(a)(1)(B)).

7 (d) NO REQUIREMENT TO COLLECT OR MAINTAIN

8 DATA.—Nothing in this Act shall be interpreted to require

9 an operator to collect or maintain any data that would

10 not otherwise be collected or maintained.

11 SEC. 3. SAFE HARBORS.

12 (a) GUIDELINES.—An operator may satisfy the re13 quirements of regulations issued under section 2(b) by fol14 lowing a set of self-regulatory guidelines, issued by rep15 resentatives of the marketing or online industries, or by

16 other persons, approved under subsection (b).

17 (b) INCENTIVES.—

18 (1) SELF-REGULATORY INCENTIVES.—In pre19 scribing regulations under section 2, the Commission

20 shall provide incentives for self-regulation by opera21 tors to implement the protections afforded under the

22 regulatory requirements described in subsection (b)

23 of that section.

24 (2) DEEMED COMPLIANCE.—Such incentives

25 shall include provisions for ensuring that a person
7

•HR 89 IH

1 will be deemed to be in compliance with the require2 ments of the regulations under section 2 if that per3 son complies with guidelines that, after notice and

4 comment, are approved by the Commission upon

5 making a determination that the guidelines meet the

6 requirements of the regulations issued under section

7 2.

8 (3) EXPEDITED RESPONSE TO REQUESTS.—The

9 Commission shall act upon requests for safe harbor

10 treatment within 180 days of the filing of the re11 quest, and shall set forth in writing its conclusions

12 with regard to such requests.

13 (c) APPEALS.—Final action by the Commission on a

14 request for approval of guidelines, or the failure to act

15 within 180 days on a request for approval of guidelines,

16 submitted under subsection (b) may be appealed to a dis17 trict court of the United States of appropriate jurisdiction

18 as provided for in section 706 of title 5, United States

19 Code.

20 SEC. 4. ACTIONS BY STATES.

21 (a) IN GENERAL.—

22 (1) CIVIL ACTIONS.—In any case in which the

23 attorney general of a State has reason to believe

24 that an interest of the residents of that State has

25 been or is threatened or adversely affected by the
8

•HR 89 IH

1 engagement of any person in a practice that violates

2 any regulation of the Commission prescribed under

3 section 2(b) of this Act, the State may bring a civil

4 action on behalf of the residents of the State in a

5 district court of the United States of appropriate ju6 risdiction to—

7 (A) enjoin that practice;

8 (B) enforce compliance with the regulation;

9 (C) obtain damage, restitution, or other

10 compensation on behalf of residents of the

11 State; or

12 (D) obtain such other relief as the court

13 may consider to be appropriate.

14 (2) NOTICE.—

15 (A) IN GENERAL.—Before filing an action

16 under paragraph (1), the attorney general of

17 the State involved shall provide to the

18 Commission—

19 (i) written notice of that action; and

20 (ii) a copy of the complaint for that

21 action.

22 (B) EXEMPTION.—

23 (i) IN GENERAL.—Subparagraph (A)

24 shall not apply with respect to the filing of

25 an action by an attorney general of a State
9

•HR 89 IH

1 under this subsection, if the attorney gen2 eral determines that it is not feasible to

3 provide the notice described in that sub4 paragraph before the filing of the action.

5 (ii) NOTIFICATION.—In an action de6 scribed in clause (i), the attorney general

7 of a State shall provide notice and a copy

8 of the complaint to the Commission at the

9 same time as the attorney general files the

10 action.

11 (b) INTERVENTION.—

12 (1) IN GENERAL.—On receiving notice under

13 subsection (a)(2), the Commission shall have the

14 right to intervene in the action that is the subject

15 of the notice.

16 (2) EFFECT OF INTERVENTION.—If the Com17 mission intervenes in an action under subsection (a),

18 it shall have the right—

19 (A) to be heard with respect to any matter

20 that arises in that action; and

21 (B) to file a petition for appeal.

22 (3) AMICUS CURIAE.—Upon application to the

23 court, a person whose self-regulatory guidelines have

24 been approved by the Commission and are relied

25 upon as a defense by any defendant to a proceeding
10

•HR 89 IH

1 under this section may file amicus curiae in that

2 proceeding.

3 (c) CONSTRUCTION.—For purposes of bringing any

4 civil action under subsection (a), nothing in this Act shall

5 be construed to prevent an attorney general of a State

6 from exercising the powers conferred on the attorney gen7 eral by the laws of that State to—

8 (1) conduct investigations;

9 (2) administer oaths or affirmations; or

10 (3) compel the attendance of witnesses or the

11 production of documentary and other evidence.

12 (d) VENUE; SERVICE OF PROCESS.—

13 (1) VENUE.—Any action brought under sub14 section (a) may be brought in the district court of

15 the United States that meets applicable require16 ments relating to venue under section 1391 of title

17 28, United States Code.

18 (2) SERVICE OF PROCESS.—In an action

19 brought under subsection (a), process may be served

20 in any district in which the defendant—

21 (A) is an inhabitant; or

22 (B) may be found.
11

•HR 89 IH

1 SEC. 6. ADMINISTRATION AND APPLICABILITY OF ACT.

2 (a) IN GENERAL.—Except as otherwise provided, this

3 Act shall be enforced by the Commission under the Fed4 eral Trade Commission Act (15 U.S.C. 41 et seq.).

5 (b) PROVISIONS.—Compliance with the requirements

6 imposed under this Act shall be enforced under—

7 (1) section 8 of the Federal Deposit Insurance

8 Act (12 U.S.C. 1818), in the case of—

9 (A) national banks, and Federal branches

10 and Federal agencies of foreign banks, by the

11 Office of the Comptroller of the Currency;

12 (B) member banks of the Federal Reserve

13 System (other than national banks), branches

14 and agencies of foreign banks (other than Fed15 eral branches, Federal agencies, and insured

16 State branches of foreign banks), commercial

17 lending companies owned or controlled by for18 eign banks, and organizations operating under

19 section 25 or 25(a) of the Federal Reserve Act

20 (12 U.S.C. 601 et seq. and 611 et seq.), by the

21 Board; and

22 (C) banks insured by the Federal Deposit

23 Insurance Corporation (other than members of

24 the Federal Reserve System) and insured State

25 branches of foreign banks, by the Board of Di-
12

•HR 89 IH

1 rectors of the Federal Deposit Insurance Cor2 poration;

3 (2) section 8 of the Federal Deposit Insurance

4 Act (12 U.S.C. 1818), by the Director of the Office

5 of Thrift Supervision, in the case of a savings asso6 ciation the deposits of which are insured by the Fed7 eral Deposit Insurance Corporation;

8 (3) the Federal Credit Union Act (12 U.S.C.

9 1751 et seq.) by the National Credit Union Adminis10 tration Board with respect to any Federal credit

11 union;

12 (4) part A of subtitle VII of title 49, United

13 States Code, by the Secretary of Transportation

14 with respect to any air carrier or foreign air carrier

15 subject to that part;

16 (5) the Packers and Stockyards Act, 1921 (7

17 U.S.C. 181 et seq.) (except as provided in section

18 406 of that Act (7 U.S.C. 226, 227)), by the Sec19 retary of Agriculture with respect to any activities

20 subject to that Act; and

21 (6) the Farm Credit Act of 1971 (12 U.S.C.

22 2001 et seq.) by the Farm Credit Administration

23 with respect to any Federal land bank, Federal land

24 bank association, Federal intermediate credit bank,

25 or production credit association.
13

•HR 89 IH

1 (c) EXERCISE OF CERTAIN POWERS.—For the pur2 pose of the exercise by any agency referred to in sub3 section (b) of its powers under any other Act referred to

4 in that subsection, a violation of any requirement imposed

5 under this Act shall be deemed to be a violation of a re6 quirement imposed under that other Act. In addition to

7 its powers under any provision of law specifically referred

8 to in subsection (b), each of the agencies referred to in

9 that subsection may exercise, for the purpose of enforcing

10 compliance with any requirement imposed under this Act,

11 any other authority conferred on such agency by law.

12 (d) ACTIONS BY THE COMMISSION.—The Commis13 sion shall prevent any person from violating a rule of the

14 Commission under section 2 in the same manner, by the

15 same means, and with the same jurisdiction, powers, and

16 duties as though all applicable terms and provisions of the

17 Federal Trade Commission Act (15 U.S.C. 41 et seq.)

18 were incorporated into and made a part of this title. Any

19 entity that violates such rule shall be subject to the pen20 alties and entitled to the privileges and immunities pro21 vided in the Federal Trade Commission Act in the same

22 manner, by the same means, and with the same jurisdic23 tion, power, and duties as though all applicable terms and

24 provisions of the Federal Trade Commission Act were in25 corporated into and made a part of this title.
14

•HR 89 IH

1 (e) EFFECT ON OTHER LAWS.—Nothing contained in

2 this Act shall be construed to limit the authority of the

3 Commission under any other provisions of law.

4 (f) PREEMPTION.—Except as otherwise provided in

5 this Act, this Act supersedes State law to the extent that

6 it establishes a rule of law applicable to an online privacy

7 action that is inconsistent with State law. Nothing in this

8 Act supersedes State law with respect to prosecution of

9 fraud.

10 SEC. 6. REVIEW.

11 Not later than 5 years after the effective date of the

12 regulations initially issued under section 2, the Commis13 sion shall—

14 (1) review the implementation of this Act, in15 cluding the effect of the implementation of this title

16 on practices relating to the collection and disclosure

17 of information; and

18 (2) prepare and submit to Congress a report on

19 the results of the review under paragraph (1).

20 SEC. 7. EFFECTIVE DATE.

21 Sections 3(a), 5, and 6 of this Act shall take effect

22 on the later of—

23 (1) the date that is 18 months after the date

24 of enactment of this Act; or
15

•HR 89 IH

1 (2) the date on which the Commission rules on

2 the first application filed for safe harbor treatment

3 under section 3 if the Commission does not rule on

4 the first such application within one year after the

5 date of enactment of this Act, but in no case later

6 than the date that is 30 months after the date of

7 enactment of this Act.

8 SEC. 8. DEFINITIONS.

9 In this Act:

10 (1) INDIVIDUAL.—The term ‘‘individual’’ means

11 a natural person of age 13 and above.

12 (2) OPERATOR.—The term ‘‘operator’’—

13 (A) means any person who operates a Web

14 site located on the Internet or an online service

15 and who collects or maintains personal informa16 tion from or about the users of or visitors to

17 such Web site or online service, or on whose be18 half such information is collected or main19 tained, where such Web site or online service is

20 operated for commercial purposes, including

21 any person offering products or services for sale

22 through that Web site or online service, involv23 ing commerce—

24 (i) among the several States or with 1

25 or more foreign nations;
16

•HR 89 IH

1 (ii) in any territory of the United

2 States or in the District of Columbia, or

3 between any such territory and—

4 (I) another such territory; or

5 (II) any State or foreign nation;

6 or

7 (iii) between the District of Columbia

8 and any State, territory, or foreign nation;

9 but

10 (B) does not include any nonprofit entity

11 that would otherwise be exempt from coverage

12 under section 5 of the Federal Trade Commis13 sion Act (15 U.S.C. 45).

14 (3) COMMISSION.—The term ‘‘Commission’’

15 means the Federal Trade Commission.

16 (4) DISCLOSURE.—The term ‘‘disclosure’’

17 means, with respect to personal information the re18 lease of personal information collected in identifiable

19 form by an operator for any purpose, except where

20 such information is provided to a person other than

21 the operator who provides support for the internal

22 operations of the Web site and does not disclose or

23 use that information for any other purpose.
17

•HR 89 IH

1 (5) FEDERAL AGENCY.—The term ‘‘Federal

2 agency’’ means an agency, as that term is defined

3 in section 551(1) of title 5, United States Code.

4 (6) INTERNET.—The term ‘‘Internet’’ means

5 collectively the myriad of computer and tele6 communications facilities, including equipment and

7 operating software, which comprise the inter8 connected world-wide network of networks that em9 ploy the Transmission Control Protocol/Internet

10 Protocol, or any predecessor or successor protocols

11 to such protocol, to communicate information of all

12 kinds by wire or radio.

13 (7) TRANSACTIONAL INFORMATION.—The term

14 ‘‘transactional information’’ means information gen15 erated in connection with the process of requesting,

16 accessing, or otherwise using the Internet.

17 (8) PERSONAL INFORMATION.—The term ‘‘per18 sonal information’’ means information collected on19 line from an individual that identifies that indi20 vidual, including—

21 (A) first and last name;

22 (B) home and other physical address;

23 (C) e-mail address;

24 (D) social security number;

25 (E) telephone number;
18

•HR 89 IH

1 (F) any other identifier that the Commis2 sion determines identifies an individual; or

3 (G) information that is maintained with, or

4 can be searched or retrieved by means of, data

5 described in subparagraphs (A) through (F).

Æ